Debuger: Pesudo-Valude & Pesudo-Register

• 伪变量是用于在变量窗口或“快速监视”对话框中显示某些信息的术语。 你可以像输入普通变量那样输入伪变量。 但伪变量不是变量，它不与程序中的变量名相对应

$err：		显示函数 SetLastError 设置的上一个错误值。 显示的值代表将由 GetLastError 函数返回的值。
$err,hr：	查看此值的已解码形式。 例如，如果上一个错误是 3，则 $err,hr 将显示 ERROR_PATH_NOT_FOUND : The system cannot find the path specified.
$handles：	显示应用程序中分配的句柄数。
$vframe：	显示当前堆栈帧的地址。
$tid：		显示当前线程的线程 ID。
$env：		在字符串查看器中显示环境块。
$cmdline：	显示已启动程序的命令行字符串。
$pid：		显示进程 ID。
$registername or @registername：显示寄存器“registerName”的内容。
通常，只需输入寄存器名便可以显示寄存器的内容。 仅在寄存器名重载变量名时才需要使用此语法。 如果寄存器名与当前范围内的某个变量名同名，则调试器将该名称解释为变量名。 这时就需要使用 $ registername 或 @ registername 寄存器名 。
$clk：		以时钟形式显示时间。
$user：		显示一个结构，在该结构中含有应用程序运行于的帐户的帐户信息。 出于安全原因，将不显示密码信息。
$exceptionstack：显示当前 Windows 运行时异常的堆栈跟踪。 $ exceptionstack 仅适用于 UWP 应用。 C++ 异常和 SEH 异常不支持 $ exceptionstack
$returnvalue：	显示方法的返回值。

• Pseudo-Register Syntax ： 是调试器伪寄存器，伪寄存器存储特定的值
• 所有的Pseudo-Register都是以$开头
• If you are using MASM syntax, you can add an @ before $. It can tell the debuger that the following value is a register or pesudo-register, not a symbol. If you omit the at sign, the debugger responds more slowly, because it has to search the whole symbol table.

$ea
The effective address of the last instruction that was executed. If this instruction does not have an effective address, the debugger displays "Bad register error". If this instruction has two effective addresses, the debugger displays the first address.

$ea2
The second effective address of the last instruction that was executed. If this instruction does not have two effective addresses, the debugger displays "Bad register error".

$exp
The last expression that was evaluated.

$ra
The return address that is currently on the stack.
This address is especially useful in execution commands. For example, g @$ra continues until the return address is found (although gu (Go Up) is a more precise effective way of "stepping out" of the current function).

$ip
The instruction pointer register.
x86-based processors: The same as eip. Itanium-based processors: Related to iip. (For more information, see the note following this table.) x64-based processors: The same as rip.

$eventip
The instruction pointer at the time of the current event. This pointer typically matches $ip, unless you switched threads or manually changed the value of the instruction pointer.

$previp
The instruction pointer at the time of the previous event. (Breaking into the debugger counts as an event.)

$relip
An instruction pointer that is related to the current event. When you are branch tracing, this pointer is the pointer to the branch source.

$scopeip
The instruction pointer for the current local context (also known as the scope).

$exentry
The address of the entry point of the first executable of the current process.

$retreg
The primary return value register.
x86-based processors: The same as eax. Itanium-based processors: The same as ret0. x64-based processors: The same as rax.

$retreg64
The primary return value register, in 64-bit format.
x86 processor: The same as the edx:eax pair.

$csp
The current call stack pointer. This pointer is the register that is most representative of call stack depth.
x86-based processors: The same as esp. Itanium-based processors: The same as bsp. x64-based processors: The same as rsp.

$p
The value that the last d* (Display Memory) command printed.

$proc
The address of the current process (that is, the address of the EPROCESS block).

$thread
The address of the current thread. In kernel-mode debugging, this address is the address of the ETHREAD block. In user-mode debugging, this address is the address of the thread environment block (TEB).

$peb
The address of the process environment block (PEB) of the current process.

$teb
The address of the thread environment block (TEB) of the current thread.

$tpid
The process ID (PID) for the process that owns the current thread.

$tid
The thread ID for the current thread.

$bpNumber
The address of the corresponding breakpoint. For example, $bp3 (or $bp03) refers to the breakpoint whose breakpoint ID is 3. Number is always a decimal number. If no breakpoint has an ID of Number, $bpNumber evaluates to zero. For more information about breakpoints, see Using Breakpoints.

$frame
The current frame index. This index is the same frame number that the .frame (Set Local Context) command uses.

$dbgtime
The current time, according to the computer that the debugger is running on.

$callret
The return value of the last function that .call (Call Function) called or that is used in an .fnret /s command. The data type of $callret is the data type of this return value.

$lastclrex
Managed debugging only: The address of the last-encountered common language runtime (CLR) exception object.

$ptrsize
The size of a pointer. In kernel mode, this size is the pointer size on the target computer.

$pagesize
The number of bytes in one page of memory. In kernel mode, this size is the page size on the target computer.

$exr_chance
The chance of the current exception record.

$exr_code
The exception code for the current exception record.

$exr_numparams
The number of parameters in the current exception record.

$exr_param0
The value of Parameter 0 in the current exception record.

$exr_param1
The value of Parameter 1 in the current exception record.

$exr_param2
The value of Parameter 2 in the current exception record.

$exr_param3
The value of Parameter 3 in the current exception record.

$exr_param4
The value of Parameter 4 in the current exception record.

$exr_param5
The value of Parameter 5 in the current exception record.

$exr_param6
The value of Parameter 6 in the current exception record.

$exr_param7
The value of Parameter 7 in the current exception record.

$exr_param8
The value of Parameter 8 in the current exception record.

$exr_param9
The value of Parameter 9 in the current exception record.

$exr_param10
The value of Parameter 10 in the current exception record.

$exr_param11
The value of Parameter 11 in the current exception record.

$exr_param12
The value of Parameter 12 in the current exception record.

$exr_param13
The value of Parameter 13 in the current exception record.

$exr_param14
The value of Parameter 14 in the current exception record.

$bug_code
If a bug check has occurred, this is the bug code. Applies to live kernel-mode debugging and kernel crash dumps.

$bug_param1
If a bug check has occurred, this is the value of Parameter 1. Applies to live kernel-mode debugging and kernel crash dumps.

$bug_param2
If a bug check has occurred, this is the value of Parameter 2. Applies to live kernel-mode debugging and kernel crash dumps.

$bug_param3
If a bug check has occurred, this is the value of Parameter 3. Applies to live kernel-mode debugging and kernel crash dumps.

$bug_param4
If a bug check has occurred, this is the value of Parameter 4. Applies to live kernel-mode debugging and kernel crash dumps.